Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,379
- High8,744
- Medium6,789
- Low727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2013-7460—29.8%
——9——CVE-2008-5298—29.8%
——9——CVE-2011-5152—29.8%
——9——CVE-2005-2663—29.8%
——9——CVE-2024-13363—29.8%
——9——CVE-2010-5199—29.8%
——9——CVE-2024-21658—29.8%
——9——CVE-2025-49603—29.8%
——9——CVE-2026-843066.5 MED29.8%
——9Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.14dCVE-2022-42841—29.8%
——9——CVE-2004-0422—29.8%
——9——CVE-2020-1739—29.8%
——9——CVE-2005-3121—29.8%
——9——CVE-2026-56326—29.8%
——9——CVE-2005-3111—29.8%
——9——CVE-2004-0559—29.8%
——9——CVE-2005-2992—29.8%
——9——CVE-2010-5222—29.8%
——9——CVE-2026-30241—29.8%
——9——CVE-2006-0055—29.8%
——9——CVE-2017-18397—29.8%
——9——CVE-2026-927179.1 CRI29.8%
——9Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.2dCVE-2020-8744—29.8%
——9——CVE-2017-18422—29.8%
——9——CVE-2024-9436—29.8%
——9——CVE-2026-45178—29.8%
——9——CVE-2026-67847.5 HIG29.8%
——9Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150 and Thunderbird 150.66dCVE-2024-13431—29.8%
——9——CVE-2002-1392—29.8%
——9——CVE-2012-4756—29.8%
——9——CVE-2004-1336—29.8%
——9——CVE-2015-10081—29.8%
——9——CVE-2004-1032—29.8%
——9——CVE-2011-1376—29.8%
——9——CVE-2005-2660—29.8%
——9——CVE-2005-3341—29.8%
——9——CVE-2025-24805—29.8%
——9——CVE-2006-3856—29.8%
——9——CVE-2026-163767.5 HIG29.8%
——9Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.56dCVE-2005-2240—29.8%
——9——